PT-2025-11647 · WordPress · S2Member Pro

István Márton · Published 2025-03-18 · Updated 2025-03-19 · CVE-2024-12563

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions s2Member Pro plugin for WordPress versions up to, and including, 250214

Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the template attribute. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution.

Recommendations For versions up to, and including, 250214, consider disabling the template attribute until a patch is available to prevent exploitation. Restrict access to sensitive files and directories to minimize the risk of arbitrary file inclusion. Update to a version that includes a fix for this issue when available.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-12563

Affected Products

S2Member Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-12563 · Security Note
• https://twitter.com/CveFindCom/status/1902102976732557354 · Twitter Post
• https://twitter.com/vulns_space/status/1902112945774985725 · Twitter Post
• https://t.me/cvetracker/19408 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d3326e9d-504f-444f-baf7-03989594f483?source=cve · Note
• https://twitter.com/CVEnew/status/1902098961030324232 · Twitter Post
• https://t.me/cvedetector/20611 · Telegram Post
• https://s2member.com/changelog · Note